MONTREAL – The Quebec provincial police have confirmed the arrest of a suspect linked to a significant data breach at Desjardins. Juan Pablo Serrano, 40, was apprehended in Spain on November 6, 2025, after evading capture since June 2024.

Serrano is accused of participating in the theft and resale of sensitive personal data affecting approximately 9.7 million members of the Quebec financial institution, Desjardins. Authorities allege that he acquired the stolen information from a former employee of Desjardins and subsequently exploited it to facilitate various fraudulent schemes.

The arrest was made possible through a coordinated effort involving Spanish law enforcement agencies, Quebec provincial police, and Interpol, marking a significant victory in the fight against cybercrime and identity theft. As one of Quebec's most wanted fugitives, Serrano's capture is expected to bring closure to many victims affected by this extensive data breach.

Currently, Serrano remains in custody in Spain, where he is undergoing extradition proceedings back to Canada. He faces multiple serious charges in Quebec, including fraud exceeding $5,000, identity theft, and trafficking in identifying information, all stemming from the solicitation of illicitly obtained personal data.

This incident illustrates the ongoing challenges related to the cybersecurity landscape and the imperative for financial institutions to safeguard their customers' personal information against unauthorized access and criminal activities.